@event4u/agent-config 14.12.0 → 14.14.0

package/src/scripts/_lib/council_settings_block.ts

@@ -94,6 +94,12 @@ export function synthesizeAiCouncilBlock(cfg: CouncilConfig): Dict {
             strong_threshold: cfg.consensus_scoring.strong_threshold,
             minority_threshold: cfg.consensus_scoring.minority_threshold,
             lenses: [...cfg.consensus_scoring.lenses],
+            // Phase 1B. Omitting it here is not a missing default — it is the key
+            // becoming UNREADABLE: `inlineFindingsActive` reads this projected
+            // dict, not the typed config, so an absent key resolves to `false` and
+            // the feature is silently off no matter what the YAML says. A live
+            // analysis run on 2026-08-30 is what found it, after the tests passed.
+            inline_findings: cfg.consensus_scoring.inline_findings,
         },
         cli_call_budget: {
             max_calls_per_day: _mapToObject(cfg.cli_call_budget.max_calls_per_day),

package/src/scripts/_lib/curator_ops.ts

@@ -0,0 +1,172 @@
+/**
+ * The curator's operation set — SEVEN ops per decision E6 — and the
+ * deterministic near-duplicate pre-stage that runs before any model judgment.
+ *
+ * `road-to-governed-harness-evolution` Phase 5, step 5.5.
+ *
+ * > *Curator operation set per E6. Candidates only, never promotions. Run
+ * > `src/scripts/_lib/shingle_similarity.ts` as a deterministic pre-stage
+ * > before any model judgment.*
+ * > verify: **a near-duplicate candidate is caught by the similarity stage with
+ * > zero model calls.**
+ *
+ * ## Seven, and why the middle answer was rejected
+ *
+ * E6 (decided 2026-08-30, AI council, anthropic + openai, 2/2) settled this on
+ * a contradiction rather than a preference: step 7.6 of the same roadmap
+ * already specifies the verdict set `KEEP / REVISE / MERGE / SPLIT / RETIRE`,
+ * so a four-op curator would emit verdicts it cannot execute. The six-op middle
+ * — deferring `SPLIT` — was rejected explicitly: it still contradicts 7.6, so
+ * it buys nothing the four-op answer does not also cost. The algebra argument
+ * is the one worth carrying: `MERGE` is n→1 and `SPLIT` is 1→n, and without
+ * `SPLIT` an overgrown rule becoming two must be written as
+ * `RETIRE + 2 x ADD`, which loses the semantic link and makes the intent
+ * unreadable in the audit log. {@link validateOp} encodes exactly that arity.
+ *
+ * ## Candidates only — carried by the type, not by a promise
+ *
+ * Every screened proposal carries `lifecycle: 'candidate'` as a LITERAL type,
+ * so there is no value a curator can construct that names any other lifecycle.
+ * Phase 7 is gated on the OPEN `merge-authority` blocker; a curator that could
+ * express a promotion would be one edit from performing one.
+ *
+ * ## Zero model calls, and how that is established rather than asserted
+ *
+ * {@link screenNearDuplicates} is synchronous, imports only
+ * `shingle_similarity`, and returns `model_calls: 0` as a literal-typed field.
+ * `tests/scripts/curator_ops.test.ts` proves the property two ways: it scans
+ * this module and its one dependency for network and model-client constructs in
+ * both polarities, and it runs the screen with `globalThis.fetch` replaced by a
+ * throwing stub, so a call would surface as a thrown error rather than as an
+ * unchecked assumption. An assertion by inspection would be worth nothing here
+ * — the whole point of a deterministic pre-stage is that it is cheaper than the
+ * judgment it precedes.
+ */
+import { shingleOverlap } from './shingle_similarity.js';
+
+/** E6, option B. The exact set — arity and membership are both pinned by the test. */
+export const CURATOR_OPS = [
+    'KEEP',
+    'ADD',
+    'MERGE',
+    'REPLACE',
+    'SPLIT',
+    'RETIRE',
+    'SKIP',
+] as const;
+
+export type CuratorOp = (typeof CURATOR_OPS)[number];
+
+export interface CuratorProposal {
+    id: string;
+    op: CuratorOp;
+    /** Existing artifact ids the op reads or consumes. */
+    targets: readonly string[];
+    /** Artifact ids the op would produce. Empty for read-only ops. */
+    produces: readonly string[];
+    /** The proposed text, which is what the similarity stage compares. */
+    text: string;
+}
+
+/** Arity per op. `null` means the op places no constraint on that side. */
+const OP_ARITY: Record<CuratorOp, { targets: [number, number | null]; produces: [number, number | null] }> = {
+    KEEP: { targets: [1, 1], produces: [0, 0] },
+    ADD: { targets: [0, 0], produces: [1, 1] },
+    MERGE: { targets: [2, null], produces: [1, 1] },
+    REPLACE: { targets: [1, 1], produces: [1, 1] },
+    SPLIT: { targets: [1, 1], produces: [2, null] },
+    RETIRE: { targets: [1, 1], produces: [0, 0] },
+    SKIP: { targets: [0, null], produces: [0, 0] },
+};
+
+function arityError(label: string, n: number, [lo, hi]: [number, number | null]): string | null {
+    if (n < lo) return `${label}: expected at least ${String(lo)}, got ${String(n)}`;
+    if (hi !== null && n > hi) return `${label}: expected at most ${String(hi)}, got ${String(n)}`;
+    return null;
+}
+
+/** `null` when the proposal's arity matches its op, otherwise the reason it does not. */
+export function validateOp(p: CuratorProposal): string | null {
+    const spec = OP_ARITY[p.op];
+    return (
+        arityError(`${p.op} targets`, p.targets.length, spec.targets) ??
+        arityError(`${p.op} produces`, p.produces.length, spec.produces)
+    );
+}
+
+/**
+ * Containment-overlap percent at which a proposal is a near-duplicate.
+ *
+ * A STATED default, not a measured optimum: `lint_originality`'s own gate uses
+ * shingle containment on the same primitive, and 70 % is the conservative end
+ * of the range a reskin scores there. `revisit-if` a screening run rejects a
+ * proposal a curator then has to re-add by hand, or admits one a human calls a
+ * duplicate.
+ */
+export const NEAR_DUPLICATE_THRESHOLD = 70;
+
+export interface CorpusEntry {
+    id: string;
+    text: string;
+}
+
+export interface NearDuplicateFinding {
+    proposal_id: string;
+    /** The corpus entry it duplicates. */
+    against: string;
+    overlap_percent: number;
+}
+
+export interface ScreenedProposal {
+    proposal: CuratorProposal;
+    /** Literal. There is no other value this field can hold. */
+    lifecycle: 'candidate';
+}
+
+export interface ScreenResult {
+    admitted: readonly ScreenedProposal[];
+    near_duplicates: readonly NearDuplicateFinding[];
+    malformed: readonly { proposal_id: string; reason: string }[];
+    /** Literal 0. The stage is deterministic; a model call here would be a defect. */
+    model_calls: 0;
+}
+
+/**
+ * The deterministic pre-stage: reject malformed ops and near-duplicates before
+ * anything expensive runs.
+ *
+ * Synchronous on purpose — a synchronous function cannot await a network call,
+ * so the zero-model-call property is a consequence of the signature rather than
+ * a claim the body has to keep.
+ */
+export function screenNearDuplicates(
+    proposals: readonly CuratorProposal[],
+    corpus: readonly CorpusEntry[],
+    threshold: number = NEAR_DUPLICATE_THRESHOLD,
+): ScreenResult {
+    const admitted: ScreenedProposal[] = [];
+    const nearDuplicates: NearDuplicateFinding[] = [];
+    const malformed: { proposal_id: string; reason: string }[] = [];
+
+    for (const p of proposals) {
+        const shapeError = validateOp(p);
+        if (shapeError !== null) {
+            malformed.push({ proposal_id: p.id, reason: shapeError });
+            continue;
+        }
+        let worst: NearDuplicateFinding | null = null;
+        for (const entry of corpus) {
+            const overlap = shingleOverlap(p.text, entry.text);
+            if (overlap >= threshold && (worst === null || overlap > worst.overlap_percent)) {
+                worst = { proposal_id: p.id, against: entry.id, overlap_percent: overlap };
+            }
+        }
+        if (worst !== null) {
+            nearDuplicates.push(worst);
+            continue;
+        }
+        admitted.push({ proposal: p, lifecycle: 'candidate' });
+    }
+
+    return { admitted, near_duplicates: nearDuplicates, malformed, model_calls: 0 };
+}

package/src/scripts/_lib/delivery_arm_experiment.ts

@@ -0,0 +1,282 @@
+/**
+ * The three-arm delivery experiment — `road-to-governed-harness-evolution` 6.1.
+ *
+ * WHAT 6.1 ASKS, AND WHY IT IS NOT THE PRICE GRID. Step 6.1 says: measure
+ * `eager-all` against `thin` against `delivery` — the three values
+ * `_lib/lean_projection_mode.ts:19` already declares — BEFORE any new retrieval
+ * component is written. `model_rule_injection.ts` already prices those three
+ * shapes, and a price grid is a cost model rather than a delivery measurement:
+ * it reports what each shape COSTS and never what each shape DELIVERS. The
+ * three arms differ on exactly one observable, and it is not cost:
+ *
+ *   for a given prompt, is the labelled rule's BODY in the model's context?
+ *
+ * That question is decidable from the tree, so this module answers it for all
+ * three arms over one corpus with one matcher, and reports the cost figures
+ * beside it so the arms are commensurable on one table.
+ *
+ * WHAT EACH ARM PUTS IN CONTEXT, read off the two consumers of the mode rather
+ * than assumed. `condense.ts:1124` calls `writesThinFiles(mode)`, so `thin` and
+ * `delivery` project pointer stubs where `eager-all` projects bodies;
+ * `hooks/rule_inject_hook.ts:230` calls `deliversBodies(mode)`, so only
+ * `delivery` binds the concern that injects matched bodies back at prompt time.
+ * Hence:
+ *
+ *   eager-all  every projected body is standing.
+ *   thin       kernel bodies + no-trigger residue bodies are standing; every
+ *              other body is a pointer and is NOT in context. Nothing is
+ *              injected, because the concern is not bound.
+ *   delivery   thin's standing set, PLUS the bodies `selectForInjection`
+ *              returns for this prompt under the concern's byte cap.
+ *
+ * The `thin` standing set mirrors `standingCorpora` in `model_rule_injection.ts`
+ * — kernel or triggerless keeps a body, anything else becomes a pointer — so the
+ * delivery half and the cost half classify each rule the same way. Two
+ * classifications would be the "measures nothing" defect `_lib/rule_injection.ts`
+ * names in its own header.
+ *
+ * NO SECOND MATCHER, WHICH IS 6.2'S CONSTRAINT AND THIS MODULE'S TOO. Every
+ * match here comes from `matchTierRules`, and every selection from
+ * `selectForInjection` — both in `_lib/rule_injection.ts`, which owns no matcher
+ * of its own and wraps `_lib/router_match.ts`. This module imports nothing else
+ * that could answer "which rules fire on this prompt?", and
+ * `tests/scripts/single_matcher_preserved.test.ts` fails if it ever does.
+ *
+ * ZERO MODEL CALLS, and the property follows from the imports rather than from
+ * good behaviour: the only import is `_lib/rule_injection.js`, which reads files.
+ * Token counting and the standing-corpus sizes are PARAMETERS, not imports, so
+ * this module carries no tokenizer and no network surface at all.
+ *
+ * WHAT IT DOES NOT MEASURE, stated because the gap is the interesting half.
+ * It does not measure whether a session that RECEIVES a body behaves like a
+ * session that HAD it standing. That is not an expense this run declined to pay
+ * — the instrument is closed by ADR-202 (`docs/decisions/ADR-202-anchor-scoring-as-thin-quality-instrument.md`),
+ * whose status reads "instrument not achievable with available evaluators" at an
+ * inter-evaluator kappa of 0.472 against a registered floor of 0.800, with no
+ * third attempt licensed. Nothing printed here is evidence about quality.
+ */
+import {
+    kernelIds,
+    loadRuleBody,
+    matchTierRules,
+    selectForInjection,
+    triggerlessRuleIds,
+    type Router,
+} from './rule_injection.js';
+
+/** The three arms, named exactly as `LeanProjectionMode` declares them. */
+export const ARMS = ['eager-all', 'thin', 'delivery'] as const;
+export type ArmName = (typeof ARMS)[number];
+
+/** The corpus fields this experiment reads. Structurally a `CorpusCase`. */
+export interface LabelledCase {
+    readonly rule: string;
+    readonly prompt: string;
+    readonly openFiles: string[] | null;
+    readonly label: 'positive' | 'near_miss';
+}
+
+export interface ArmRow {
+    readonly arm: ArmName;
+    /** Positives whose labelled rule body is in context under this arm. */
+    readonly delivered: number;
+    readonly positives: number;
+    /** Near-miss prompts whose labelled rule body is nevertheless in context. */
+    readonly falseContext: number;
+    readonly nearMisses: number;
+    /** Positives the matcher fired on but the byte cap then dropped. */
+    readonly capDropped: number;
+    /** Exact-BPE tokens standing in context before the first prompt. */
+    readonly standingTokens: number;
+    /** Mean exact-BPE tokens injected per positive prompt. */
+    readonly injectedMeanTokens: number;
+    /** Same, at the 90th percentile. */
+    readonly injectedP90Tokens: number;
+}
+
+export interface ArmExperimentInput {
+    readonly repoRoot: string;
+    readonly router: Router;
+    readonly cases: readonly LabelledCase[];
+    /** The concern's per-prompt byte cap. The sensitivity handle. */
+    readonly capBytes: number;
+    /** Standing exact-BPE tokens per arm, supplied by the caller. */
+    readonly standing: Readonly<Record<ArmName, number>>;
+    /** Exact-BPE tokenizer, injected so this module imports none. */
+    readonly tokensOf: (text: string) => number;
+    /**
+     * STEP 6.3 — optional per-prompt lexical shortlist, injected so this module
+     * builds no index of its own.
+     *
+     * Absent (the default) the delivery arm is byte-for-byte the arm 6.1
+     * measured, which is why its recorded figures stay reproducible. Present,
+     * it reaches `selectForInjection` as a TIE-BREAK under the matcher's score —
+     * it can change which matched bodies survive a binding cap and can change
+     * nothing else, so `delivered` can only move through `capDropped`.
+     */
+    readonly shortlist?: ((prompt: string) => readonly string[]) | null;
+}
+
+/**
+ * Ids whose FULL body is standing under `thin` and `delivery`.
+ *
+ * Kernel is standing by definition; a rule with no trigger cannot be delivered,
+ * so the projector keeps it eager under the thin shapes too.
+ */
+export function thinStandingIds(router: Router): Set<string> {
+    const ids = new Set<string>(kernelIds(router));
+    for (const id of triggerlessRuleIds(router)) ids.add(id);
+    return ids;
+}
+
+/** Nearest-rank quantile over a copy. Deterministic. */
+function quantile(values: readonly number[], q: number): number {
+    if (values.length === 0) return 0;
+    const s = [...values].sort((a, b) => a - b);
+    const idx = Math.min(s.length - 1, Math.max(0, Math.ceil(q * s.length) - 1));
+    return s[idx] as number;
+}
+
+function mean(values: readonly number[]): number {
+    if (values.length === 0) return 0;
+    return values.reduce((a, b) => a + b, 0) / values.length;
+}
+
+/** Ids projected with a real body file — the `eager-all` standing set. */
+function hasBody(repoRoot: string, id: string): boolean {
+    return loadRuleBody(repoRoot, id) !== null;
+}
+
+/**
+ * Run the experiment. Pure over its inputs; two runs are byte-identical.
+ *
+ * One walk over the corpus computes all three arms, so no arm can be scored on
+ * a different case set than another.
+ */
+export function runArmExperiment(input: ArmExperimentInput): ArmRow[] {
+    const { repoRoot, router, cases, capBytes, standing, tokensOf, shortlist } = input;
+    const thinStanding = thinStandingIds(router);
+
+    const delivered: Record<ArmName, number> = { 'eager-all': 0, thin: 0, delivery: 0 };
+    const falseContext: Record<ArmName, number> = { 'eager-all': 0, thin: 0, delivery: 0 };
+    let positives = 0;
+    let nearMisses = 0;
+    let capDropped = 0;
+    const injectedTokens: number[] = [];
+
+    for (const c of cases) {
+        const inEager = hasBody(repoRoot, c.rule);
+        const inThin = thinStanding.has(c.rule) && inEager;
+
+        const matches = matchTierRules(router, c.prompt, c.openFiles);
+        const sel = selectForInjection(
+            repoRoot,
+            matches,
+            capBytes,
+            shortlist ? shortlist(c.prompt) : null,
+        );
+        const injectedIds = new Set(sel.selected.map((m) => m.id));
+        const inDelivery = inThin || injectedIds.has(c.rule);
+
+        if (c.label === 'positive') {
+            positives += 1;
+            if (inEager) delivered['eager-all'] += 1;
+            if (inThin) delivered.thin += 1;
+            if (inDelivery) delivered.delivery += 1;
+            if (sel.dropped.some((m) => m.id === c.rule)) capDropped += 1;
+            let tokens = 0;
+            for (const m of sel.selected) tokens += tokensOf(loadRuleBody(repoRoot, m.id) ?? '');
+            injectedTokens.push(tokens);
+        } else {
+            nearMisses += 1;
+            if (inEager) falseContext['eager-all'] += 1;
+            if (inThin) falseContext.thin += 1;
+            if (inDelivery) falseContext.delivery += 1;
+        }
+    }
+
+    const injMean = Math.round(mean(injectedTokens));
+    const injP90 = quantile(injectedTokens, 0.9);
+    return ARMS.map((arm) => ({
+        arm,
+        delivered: delivered[arm],
+        positives,
+        falseContext: falseContext[arm],
+        nearMisses,
+        capDropped: arm === 'delivery' ? capDropped : 0,
+        standingTokens: standing[arm],
+        injectedMeanTokens: arm === 'delivery' ? injMean : 0,
+        injectedP90Tokens: arm === 'delivery' ? injP90 : 0,
+    }));
+}
+
+function ratio(hits: number, total: number): string {
+    return total === 0 ? '—' : (hits / total).toFixed(3);
+}
+
+function signed(n: number): string {
+    return n > 0 ? `+${n}` : String(n);
+}
+
+/**
+ * Render the report. The pairwise deltas are printed, not left to the reader:
+ * "measured against one another" is a comparison, and a table of three
+ * independent rows is three measurements rather than one comparison.
+ */
+export function renderArmExperiment(rows: readonly ArmRow[], capBytes: number): string[] {
+    const by = new Map<ArmName, ArmRow>(rows.map((r) => [r.arm, r]));
+    const eager = by.get('eager-all') as ArmRow;
+    const thin = by.get('thin') as ArmRow;
+    const delivery = by.get('delivery') as ArmRow;
+
+    const out: string[] = [];
+    const push = (s: string): void => {
+        out.push(s);
+    };
+
+    push('── three-arm delivery experiment (road-to-governed-harness-evolution 6.1) ──');
+    push(
+        `arms = LeanProjectionMode (_lib/lean_projection_mode.ts:19) · ` +
+            `one corpus · one matcher (_lib/router_match.ts) · cap ${capBytes} B`,
+    );
+    push('');
+    push('  arm          delivery(pos)    false-context(near-miss)   standing tok   injected tok/prompt');
+    for (const r of rows) {
+        const inj =
+            r.arm === 'delivery'
+                ? `mean ${r.injectedMeanTokens} p90 ${r.injectedP90Tokens}`
+                : '0';
+        push(
+            `  ${r.arm.padEnd(12)} ${ratio(r.delivered, r.positives)} (${r.delivered}/${r.positives})`.padEnd(
+                33,
+            ) +
+                `${ratio(r.falseContext, r.nearMisses)} (${r.falseContext}/${r.nearMisses})`.padEnd(27) +
+                `${r.standingTokens}`.padEnd(15) +
+                inj,
+        );
+    }
+    push('');
+    push('── pairwise deltas ──');
+    push(
+        `  thin      vs eager-all: delivery ${signed(thin.delivered - eager.delivered)} positives · ` +
+            `standing ${signed(thin.standingTokens - eager.standingTokens)} tok`,
+    );
+    push(
+        `  delivery  vs eager-all: delivery ${signed(delivery.delivered - eager.delivered)} positives · ` +
+            `standing ${signed(delivery.standingTokens - eager.standingTokens)} tok`,
+    );
+    push(
+        `  delivery  vs thin:      delivery ${signed(delivery.delivered - thin.delivered)} positives · ` +
+            `standing ${signed(delivery.standingTokens - thin.standingTokens)} tok`,
+    );
+    push(`  cap-dropped under delivery: ${delivery.capDropped} of ${delivery.positives} positives`);
+    push('');
+    push(
+        'This measures WHICH BODIES REACH CONTEXT and what they cost. It does not',
+    );
+    push(
+        'measure whether a delivered body behaves like a standing one — that instrument',
+    );
+    push('is closed by ADR-202 and this run does not reopen it.');
+    return out;
+}

package/src/scripts/_lib/delivery_criticality.ts

@@ -0,0 +1,126 @@
+/**
+ * The fail-closed delivery ladder (`road-to-runtime-context-floors` step 2.3).
+ *
+ * An obligation moved out of the always-loaded prefix onto a runtime carrier is
+ * cheaper and can be MISSING. This module is the single encoding of what happens
+ * then; the prose lives in `docs/contracts/resident-process-floors.md` § 3 and
+ * the wire shape in `src/scripts/schemas/delivery-manifest.schema.json`.
+ *
+ * Three values, not a boolean, because "may this migrate" and "what if the
+ * carrier is down" are different questions and collapsing them loses the middle
+ * case that matters:
+ *
+ *   critical-A  never migrates; stays in standing context
+ *   critical-B  may migrate; carrier down ⇒ delivered EAGERLY, never dropped
+ *   standard    may migrate; carrier down ⇒ may fail open
+ *
+ * THE DEFAULT IS `critical-B`. An obligation whose class nobody declared is one
+ * nobody classified, and the cheap reading of an unclassified obligation must not
+ * be "droppable" — that is the same fail-closed choice
+ * `check_prefix_stable_mutation` makes for an undecidable write target.
+ */
+
+export const DELIVERY_CRITICALITY = ['critical-A', 'critical-B', 'standard'] as const;
+export type DeliveryCriticality = (typeof DELIVERY_CRITICALITY)[number];
+
+/** What nobody declared. Deliberately the middle rung, never the cheap one. */
+export const DEFAULT_CRITICALITY: DeliveryCriticality = 'critical-B';
+
+export interface DeliveryEntry {
+    /** Logical obligation id — the rule, gate or floor being delivered. */
+    id: string;
+    /** Omitted ⇒ {@link DEFAULT_CRITICALITY}. */
+    criticality?: DeliveryCriticality;
+    /** The runtime carrier that would deliver it. */
+    carrier?: string;
+}
+
+export type DeliveryOutcome =
+    /** Never left standing context; the carrier is irrelevant to it. */
+    | 'standing'
+    /** The carrier delivered it. */
+    | 'carrier'
+    /** The carrier is unavailable and the obligation was delivered the expensive way. */
+    | 'eager-fallback'
+    /** The carrier is unavailable and the obligation may be omitted. */
+    | 'fail-open';
+
+export interface DeliveryDecision {
+    id: string;
+    criticality: DeliveryCriticality;
+    /** True when the value was defaulted rather than declared. */
+    defaulted: boolean;
+    outcome: DeliveryOutcome;
+    reason: string;
+}
+
+export function isDeliveryCriticality(v: unknown): v is DeliveryCriticality {
+    return typeof v === 'string' && (DELIVERY_CRITICALITY as readonly string[]).includes(v);
+}
+
+/**
+ * Resolve one obligation against carrier availability.
+ *
+ * An UNRECOGNISED declared value is not honoured and does not throw: it
+ * defaults, exactly as an omitted one does. A typo must not be able to buy a
+ * weaker rung than the default — which is the direction a throw would also
+ * prevent, but a throw would take the whole delivery down with it, and losing
+ * every obligation to protect one is the wrong trade.
+ */
+export function resolveDelivery(entry: DeliveryEntry, carrierAvailable: boolean): DeliveryDecision {
+    const declared = entry.criticality;
+    const known = isDeliveryCriticality(declared);
+    const criticality: DeliveryCriticality = known ? declared : DEFAULT_CRITICALITY;
+    const defaulted = !known;
+
+    if (criticality === 'critical-A') {
+        return {
+            id: entry.id,
+            criticality,
+            defaulted,
+            outcome: 'standing',
+            reason: 'critical-A never migrates off standing context, so carrier availability cannot reach it',
+        };
+    }
+    if (carrierAvailable) {
+        return {
+            id: entry.id,
+            criticality,
+            defaulted,
+            outcome: 'carrier',
+            reason: `delivered by carrier ${entry.carrier ?? '(unnamed)'}`,
+        };
+    }
+    if (criticality === 'critical-B') {
+        return {
+            id: entry.id,
+            criticality,
+            defaulted,
+            outcome: 'eager-fallback',
+            reason:
+                `carrier ${entry.carrier ?? '(unnamed)'} is unavailable and this obligation is critical-B` +
+                (defaulted ? ' by default (its class was not declared)' : '') +
+                ' — delivered eagerly rather than dropped',
+        };
+    }
+    return {
+        id: entry.id,
+        criticality,
+        defaulted,
+        outcome: 'fail-open',
+        reason: `carrier ${entry.carrier ?? '(unnamed)'} is unavailable and this obligation is standard — may fail open`,
+    };
+}
+
+/** Resolve a whole manifest. Order is preserved so a report reads deterministically. */
+export function resolveDeliveryManifest(
+    entries: readonly DeliveryEntry[],
+    carrierAvailable: boolean,
+): DeliveryDecision[] {
+    return entries.map((e) => resolveDelivery(e, carrierAvailable));
+}
+
+/** The obligations a carrier failure must NOT silently drop. */
+export function droppedObligations(decisions: readonly DeliveryDecision[]): DeliveryDecision[] {
+    return decisions.filter((d) => d.outcome === 'fail-open');
+}

package/src/scripts/_lib/doctor_runtime_checks.ts

@@ -0,0 +1,70 @@
+/**
+ * The two runtime-presence checks of `agent-config doctor`.
+ *
+ * PURE MOVE out of `cmd_doctor.ts`, made under the extraction discipline that
+ * file's own `_lib` siblings follow: it is ~3,700 lines and
+ * `check_source_size_budget` counts every line above 1,500, so a change that
+ * adds lines there must pay for them by taking lines away. Wiring the Phase-1
+ * install-reach checks in (`road-to-consumer-repo-reality` 1.1) charged five
+ * lines; this move returns more than that.
+ *
+ * Both checks are cohesive with each other and with nothing else in that file:
+ * each answers "is a runtime present, and what does the package do when it is
+ * not", and neither reads the manifest, the drift sets, or the project root.
+ * Their one dependency is a `which` lookup, and it is passed IN rather than
+ * imported: `shutilWhich` lives in `cmd_doctor.ts` and importing it back would
+ * make the two modules circular. A parameter is cheaper than moving a shared
+ * utility that four other call sites already resolve from there.
+ *
+ * Behaviour is unchanged — same ids, same statuses, same message strings.
+ */
+/** The doctor's structured check row. Mirrors `cmd_doctor`'s internal `Dict`. */
+export interface RuntimeCheck {
+    id: string;
+    status: 'ok' | 'warn' | 'fail' | 'skipped';
+    message: string;
+    remedy: string;
+    /** Structural compatibility with `cmd_doctor`'s `Dict` row type. */
+    [k: string]: string;
+}
+
+export function checkPythonRuntime(): RuntimeCheck {
+    // Post-teardown: the package runtime is TypeScript-on-`tsx`. python3 is no
+    // longer a runtime dependency, so this check no longer probes for an
+    // interpreter (spawning python3 here would be misleading in a python-free
+    // package). The check id is retained for the doctor's stable report shape;
+    // it always reports `ok`.
+    return {
+        id: 'python-runtime',
+        status: 'ok',
+        message: 'python3 is not a runtime dependency (TS runtime via tsx)',
+        remedy: '',
+    };
+}
+
+export function checkHumanizerRuntime(which: (name: string) => string | null): RuntimeCheck {
+    // Write-engine step 4b (humanize audit) runs `detect_ai_tells.ts` via a
+    // Node/tsx runtime "when available", degrading to a prose-only audit
+    // otherwise. This check surfaces which path a consumer install gets so the
+    // default-on behavior is not a silent surprise. Either state is healthy —
+    // the fallback is graceful by design — so it never fails the run.
+    const node = which('node');
+    if (node === null) {
+        return {
+            id: 'humanizer-runtime',
+            status: 'ok',
+            message:
+                'no Node runtime on PATH — write-engine step 4b uses the ' +
+                'prose-only humanize audit (graceful fallback)',
+            remedy:
+                'install Node to enable the mechanical detect_ai_tells.ts pass; ' +
+                'the prose audit runs regardless',
+        };
+    }
+    return {
+        id: 'humanizer-runtime',
+        status: 'ok',
+        message: `Node runtime present (${node}) — step 4b runs the mechanical detect_ai_tells.ts pass`,
+        remedy: '',
+    };
+}